Indigenous organizations: you won’t have to explain OCAP® to us
We build automation and sort out IT for First Nations governments, Indigenous organizations, and the firms that hold Indigenous data. Our founder, Oscar ONeill, has completed FNIGC’s OCAP® training, and we know why the data goes back to the community when the work is done. Canadian hosting first. Generative AI on your terms. Bring us the work and skip the onboarding.
What you can count on
- Hosting
- Your data can stay in Canadian data centres
- Generative AI
- On your terms, written down before we build
- Ownership
- Your data, your logins, your documentation: all yours
- Subprocessors
- Only if you authorize them
- When the work ends
- We delete our copies within 10 business days
* In our Data Processing Agreement, which covers the personal data we handle for you.
The hard part usually isn’t OCAP®. It’s the vendor.
Plenty of technology vendors have never heard of OCAP®. So the first three meetings are you teaching them what Ownership, Control, Access, and Possession mean, why a data sharing agreement matters, and why you can’t just drop community data into whatever tool is cheapest. Then they build what they were going to build anyway.
We start further along. We’ve worked with First Nations, Inuit, and Métis organizations for over five years, so here’s what you don’t need to explain to us:
- Why the community, not the contractor, owns the data
- What a data sharing agreement is for, and that it comes before the build, not after
- Why "we store it securely" is not the same thing as "you control it"
- That OCAP® is a First Nations framework, and Métis and Inuit communities have their own. We follow the one that applies to you
- Why "just use AI for that" is a question, not an answer
Automation, AI, or neither?
Here’s a question we hear: we need to fix our admin, and we don’t want generative AI anywhere near community data. Good news. Those two things are barely related.
Automation
Often all you need
A rule fires and a thing happens. Form submitted, Slack post created, project folder built from a template, monthly count updated. No model and no guessing. Your data moves only between the systems you have approved.
AI-assisted
Useful sometimes. Optional always
A model reads or writes something inside one step, like pulling the fields off a scanned receipt or drafting the first pass of a summary. Only where your rules allow it. When a step needs a model, it can run through a private endpoint in a Canadian cloud region. We don’t train models on your data, and we tell you which model a step uses, where it runs, and what its provider’s terms say.
AI agent
Powerful, and usually the wrong tool
You give it a goal and a pile of documents and it works through them on its own. Useful for some jobs, wrong for an intake pipeline or a reporting job, and the first thing we leave out if you don’t want it.
We like AI. We also don’t push it on people who don’t want it. Tell us no generative AI and we build without it, and it works fine.
One more honest thing. The big models are trained mostly on non-Indigenous writing, so they carry non-Indigenous assumptions. If AI is on the table at all, that is a real conversation, and local or custom models are part of it.
Where your data lives: Canada first, then the honest alternatives
Possession is the OCAP® principle about physical control of the data, so who holds your data, and where, is not a side issue. Our first answer is Canadian hosting: we run your automations, and your data can stay in Canadian data centres.
Staying on the tools you already use can work too. Google Workspace or Microsoft 365 doesn’t break OCAP® on its own, but the tools aren’t equal on where they keep data, and you should choose with that in front of you. The long answer is in Does Google Workspace Break OCAP®?
Recommended Canadian hosting with DigitalStaff Our first recommendation for community data: it can stay in Canada, and we look after it
- Who runs it
- We do: hosting, monitoring, and fixes
- Possession: where the data sits and who holds it
- Can stay in Canadian data centres, managed by us under a written agreement with you
- What else OCAP® asks of you
- Consent, data sharing agreements, access rules, and a way to give the data back. Same under every option
- AI in the mix
- Only on your terms. We name the model and where it runs, and it can use a private endpoint in a Canadian cloud region
- Cost model
- Fixed-price build, then a flat monthly fee (Managed Automation, from $1,000/mo)
- Best when…
- You want the data in Canada and nobody in-house babysitting the automations
Your existing tools Google Workspace or Microsoft 365, Slack, Zapier. Set up properly, knowing where each one keeps data
- Who runs it
- You do, with our setup and documentation
- Possession: where the data sits and who holds it
- On Google, Microsoft, Slack, or Zapier servers, on their terms. Some keep it in the US (see below)
- What else OCAP® asks of you
- Consent, data sharing agreements, access rules, and a way to give the data back. Same under every option
- AI in the mix
- Gemini or Copilot, on your vendor’s terms. We show you the switches
- Cost model
- Subscriptions you already pay, plus a fixed-price build
- Best when…
- Your tools already keep data where you need it, and your staff know them well
Self-hosted Your own servers, your own people
- Who runs it
- You do, with a technical hire
- Possession: where the data sits and who holds it
- On your own servers. The most direct form of possession, and the most work
- What else OCAP® asks of you
- Consent, data sharing agreements, access rules, and a way to give the data back. Same under every option
- AI in the mix
- Whatever you install and maintain
- Cost model
- Salary plus hardware, ongoing
- Best when…
- You have technical staff and a strong reason to hold the servers yourself
| Criteria | Canadian hosting with DigitalStaff Recommended | Your existing tools | Self-hosted |
|---|---|---|---|
| Who runs it | We do: hosting, monitoring, and fixes | You do, with our setup and documentation | You do, with a technical hire |
| Possession: where the data sits and who holds it | Can stay in Canadian data centres, managed by us under a written agreement with you | On Google, Microsoft, Slack, or Zapier servers, on their terms. Some keep it in the US (see below) | On your own servers. The most direct form of possession, and the most work |
| What else OCAP® asks of you | Consent, data sharing agreements, access rules, and a way to give the data back. Same under every option | ||
| AI in the mix | Only on your terms. We name the model and where it runs, and it can use a private endpoint in a Canadian cloud region | Gemini or Copilot, on your vendor’s terms. We show you the switches | Whatever you install and maintain |
| Cost model | Fixed-price build, then a flat monthly fee (Managed Automation, from $1,000/mo) | Subscriptions you already pay, plus a fixed-price build | Salary plus hardware, ongoing |
| Best when… | You want the data in Canada and nobody in-house babysitting the automations | Your tools already keep data where you need it, and your staff know them well | You have technical staff and a strong reason to hold the servers yourself |
Before you pick your existing tools, know where each one keeps data
Zapier stores data in the United States. Slack does too, unless you’re on a Business+ or Enterprise plan and turn on its Canadian data region. Google Workspace lets some plans keep data in the US or Europe, but Canada isn’t one of the options. Microsoft 365 business plans commit to keeping core data (email, files, Teams chats) in Canada when your account was set up in Canada. Education plans work differently.
Checked on each vendor’s own pages, October 2026: Zapier, Slack, Google Workspace, Microsoft 365.
Self-hosting is possible, and we will tell you what it costs: roughly a full-time technical person to run it well, and you should still never run your own email server. Proton and similar tools are a real option for some teams and a headache for others, and Proton keeps its data in Europe, not Canada. We will give you the honest trade-off for your team, not a sales pitch for ours.
What a small engagement actually looks like
Here’s the kind of work we mean: intake at a small consultancy, where one person holds it all together by hand and leadership makes decisions from numbers that person counted at month end.
Before
- Inquiries arrive by web form and by email to whichever staff member the client happens to know
- Someone re-posts each one into Slack by hand
- After a yes, one person builds the project, adds people to timesheets, creates the shared folder, sets up the Slack channel, and links it all together manually
- Declined work isn’t logged anywhere, so nobody can see why it was turned down
- At month end, that same person counts the inquiries by hand for leadership
After
- Every inquiry, whichever door it came through, lands in one place with the same fields
- A yes creates the project, the timesheets, the folder from a template, and the channel, all linked
- A no logs the inquiry and the reason
- The monthly count is a sheet that is already up to date
- Your ops person can run it day to day with the documentation in hand, or we host and watch it for you
We can build this on Canadian hosting with us, or on the Zapier, Slack, and Google accounts you already have. If community data runs through it, we show you which of those keep data outside Canada before you decide.
Fix what you have
Your existing Zapier or Make setup, untangled and finished. A couple of planning sessions, some homework for you (list your apps and the steps), then we build it, document it, and hand it back. Fixed price, agreed after a discovery conversation.
How we buildBuild the pipeline
A defined automation like the one above, documented and built at a fixed price agreed after discovery. It runs on Canadian hosting with us, or on your own tools if they suit the data.
See pricingKeep it running
If nobody in-house wants to look after the robots, we host, monitor, and maintain them for a flat monthly fee, and your data can stay in Canadian data centres. Managed Automation starts at $1,000 a month.
Managed AutomationWant to talk through your setup with someone who already gets it?
An IT and data stewardship review, without the sales pitch
If “get someone to look at our security” has been on your to-do list for a while, this is for you. It’s a plain-language look at how your organization holds the data it’s responsible for, and what to fix first.
It stands on its own. You don’t have to buy automation, or anything else, to get it. We scope it with you during discovery, because a small team and a large organization need different things.
- Every tool you use, who owns each account, and how they connect
- Account security: MFA, admin roles, sharing defaults, and what happens when someone leaves
- Where your data lives, under which country’s law, and what that means in practice
- AI settings inside Google Workspace or Microsoft 365 (Gemini, Copilot), and what staff are using on the side
- Backups, and whether you could actually restore from them
- Data stewardship in practice: consent, data sharing agreements, access requests, retention, and returning data to communities
- Your options for keeping data in Canada, plus the honest take on Proton and self-hosting
- A written report with fixes in priority order. Many of them your team can do without us
IT and data stewardship review
Example findings
Scoped
With you, during discovery
Plain
Language, no firewall pitch
Yours
To act on with or without us
The four OCAP® principles, and what they mean when we build
OCAP® stands for Ownership, Control, Access, and Possession. Here’s each one as the First Nations Information Governance Centre (FNIGC) defines it, in short, and what it looks like in our work.
Ownership
FNIGC’s definition, in short: A community or group owns its information collectively, the same way a person owns their personal information.
In our work: In Oscar’s words: “Your data, your logins, your documentation: all yours, written down, not in my head. You get a licence to run it, and the code itself is an option if you ever want it.”
Control
FNIGC’s definition, in short: First Nations, their communities, and their representative bodies have the right to control every part of the research and information management that affects them, from start to finish.
In our work: You decide what gets collected, who sees it, and where it goes, and we write that down before we build. Under our Data Processing Agreement you are the data controller, and we process your data only on your documented instructions.
Access
FNIGC’s definition, in short: First Nations must be able to access data about themselves and their communities wherever it is held, and decide who else gets access to it.
In our work: Your accounts and logins stay in your name, so you’re never locked out of your own systems. You decide who gets in, on your team and outside it.
Possession
FNIGC’s definition, in short: Physical control of the data. It is how ownership gets asserted and protected.
In our work: That’s why we lead with Canadian hosting, where your data can stay in Canadian data centres. If you stay on your own tools, we show you where each one keeps your data, so you choose with the facts in front of you.
Our Data Processing Agreement puts part of this in writing for the personal data we handle: you are the data controller, we process it only on your documented instructions, we don’t appoint a subprocessor unless you authorize it or transfer the data to anyone else without your written consent, and we delete our copies within 10 business days after the work ends.
Definitions summarized from FNIGC. Read the full principles at fnigc.ca. OCAP® is a registered trademark of the First Nations Information Governance Centre (FNIGC).
Indigenous data sovereignty is bigger than OCAP®
OCAP® is a First Nations framework. FNIGC describes it as specific to First Nations, not a principle for all Indigenous Peoples. Métis and Inuit governments and organizations have their own data governance principles, and if that’s you, we follow yours.
For Inuit, Inuit Tapiriit Kanatami’s National Inuit Strategy on Research (2018) makes Inuit access, ownership, and control over data and information one of its five priority areas.
Internationally, the CARE Principles for Indigenous Data Governance from the Global Indigenous Data Alliance ask that data about Indigenous Peoples bring collective benefit, respect their authority to control it, and be handled with responsibility and ethics.
Bring us the framework your community works under, and that is what we build to.
Six questions to ask any vendor. Including us.
Take these into every sales call. A vendor who has genuinely worked with Indigenous organizations answers them without flinching. Our answers are on this page.
- Who owns the data, the logins, the documentation, and the code?
- Where will our data live, under whose law, and who can reach it?
- Does anything train on our data? Your tools, or the AI features inside our own platforms?
- What happens to our data and our accounts when we stop working together?
- Who at your company has completed FNIGC’s Fundamentals of OCAP® course?
- Can we read your data processing agreement before we sign anything?
The longer version is in Guarding Digital Heritage.
Who this page is for
Four kinds of organizations end up here. All four are welcome.
First Nations governments and band offices
Federal reporting, PSSSP, NIHB claims, membership records. More on that work is on our Indigenous Communities page. Indigenous Communities.
Indigenous organizations
Health and education organizations, associations, and non-profits that serve First Nations, Inuit, or Métis people.
Indigenous-owned firms that work with Nations
Planners, consultants, engineers, researchers. You are not a Nation, but you hold Nations’ data on their behalf. OCAP® still shapes how you should work with First Nations data, and we can help you set that up.
Non-Indigenous organizations holding Indigenous data
Universities, research groups, municipalities, health authorities. If you are wondering whether you should even be asking us, the answer is yes.
“The team is friendly, reliable and extremely patient to ensuring our concerns are addressed and understood.”
Marilee A Nowgesic
CEO, Canadian Indigenous Nurses Association
Indigenous organizations we’ve worked with
The Alberta First Nations Information Governance Centre (AFNIGC), the Blackfoot Confederacy and the Canadian Indigenous Nurses Association (CINA).
More on how we work with band offices and Nations on the Indigenous Communities page, and on protecting community data in Guarding Digital Heritage.
Questions we get on the first call
We are not a First Nation, but we hold First Nations data. Does OCAP® apply to us, and can you help?
Yes on both counts. OCAP® describes the rights of the First Nations whose data it is. If you hold that data as a consultant, a health organization, or a researcher, you are a steward of it, and the principles tell you how to behave: get consent, write the agreement, control access, know who physically holds the data, and give it back. We help stewards set that up, not only Nations.
Does using Google Workspace or Microsoft 365 violate OCAP®?
Not on its own, but the choice isn’t neutral. Possession is about physical control of the data, and on these platforms Google or Microsoft hold it on their terms. Microsoft 365 business plans commit to keeping core data (email, files, Teams chats) in Canada when your account was set up in Canada. Google Workspace doesn’t offer Canada as a data region; its options are the US and Europe. Whichever you use, consent, agreements, access rules, and a way to give the data back still matter. If keeping data in Canada matters to your community, that points to Canadian hosting or a Canadian Microsoft 365 setup.
Is Gemini or Copilot reading our email and training on it?
It can read your data to do its job inside your account. Training is a separate question, and the answer comes from Google and Microsoft, not from us. Google says Workspace content isn’t used for generative AI model training outside your domain without permission. Microsoft says Copilot prompts, responses, and the work data it pulls in aren’t used to train its foundation models. Both commitments cover paid business plans, not free personal accounts. If you would rather the AI did nothing at all, the controls exist and we will show you where they are.
Should we move to Proton, or host everything ourselves?
Sometimes. Proton and similar tools are real options for a small team that mostly needs email and files, and a headache for a team that lives in shared documents. Proton also keeps its data in Europe, not Canada. Self-hosting is possible and costs roughly a full-time technical person to run well. Whatever you do, don’t run your own email server. We will give you the honest trade-off for your team, not a pitch.
Can we keep everything on our own Zapier, Slack, and Google, and just have you set it up once?
Yes. We can build on our infrastructure, hosted in Canada, or inside your own accounts. It depends on what your data needs. One honest flag first: Zapier stores data in the United States. Slack does too, unless you are on a Business+ or Enterprise plan with its Canadian data region turned on. Google Workspace can’t commit to keeping your data in Canada. If that is acceptable for the data involved, we plan it with you, build it in your accounts, document it, and train your ops person. If it isn’t, we can run the same automation on Canadian hosting instead.
Do we need AI at all?
Usually not. A lot of admin work is plain automation: a form comes in, a Slack post goes out, a folder gets built. No model involved. If you tell us no generative AI, we build without it and it works fine. If a step would genuinely benefit from AI, we will say so, explain what it touches, and let you decide.
Do you do IT or cyber security audits?
We do an IT and data stewardship review, described above. It covers how your tools are connected, how your accounts are secured, where your data lives, what your AI settings are doing, and how you handle consent, agreements, and returning data. It stands on its own, so you don’t have to buy automation to get it. We scope it with you during discovery.
Who owns the automations and the data when the project ends?
In Oscar’s words: “Your data, your logins, your documentation: all yours, written down, not in my head. You get a licence to run it, and the code itself is an option if you ever want it.” Our Data Processing Agreement adds the legal side for personal data: you are the data controller, we don’t transfer it to anyone else without your written consent, and we delete our copies within 10 business days after the work ends.
Is DigitalStaff "OCAP® certified"?
No. FNIGC’s Fundamentals of OCAP® course gives each person who completes it a Statement of Achievement, which speaks to that person’s training. FNIGC has also announced an OCAP® certification process for research projects. Neither one makes a technology company “OCAP® certified,” so if a vendor tells you it is, ask what exactly was certified, and by whom. Our founder, Oscar ONeill, has completed FNIGC’s OCAP® training, and we have built our habits around the principles. That is the honest version of the claim.
Do you work with Métis and Inuit organizations?
Yes. OCAP® is a First Nations framework, and Métis and Inuit governments and organizations have their own data governance principles. We follow yours rather than assuming OCAP® covers everyone. Bring us the framework your community works under, and that is what we build to.
What does a small engagement cost?
We don’t bill by the hour. Builds are fixed price, agreed after a discovery conversation. If you want a full roadmap first, our Discovery Sprint is $3,000 to $5,000. If you want us to host and look after your automations afterwards, Managed Automation starts at $1,000 a month. The IT and data stewardship review is scoped with you during discovery. A short call is the fastest way to get a real number for your situation.